IAM engineer roles require training and flexibility

IAM job market landscape

Job growth in IAM has surged in the past year, with about 1,500 IAM engineer openings currently in the Boston area, 4,800 in the D.C. area and 3,320 in Silicon Valley, according to a presentation by Dave Shields, a senior security architect for IAM at DST Systems, a financial technology company in Kansas City.

"It is finally reaching a state where people see that it's a viable place to have [a career]," said Shields, who was also recently the managing director of IT and ran IAM at the University of Oklahoma. "There are so many things you can do with it."

There aren't enough people already skilled in IAM to fill these roles, however, and ones that are may not live nearby. Instead, IT departments can train up existing staff on IAM -- but the key is to choose the right people.

"The best engineers you're going to find are the people who aren't afraid to break stuff," Shields said. "Maybe you have a sysadmin who gets into systems and was able to make them do things they were never able to do before. Talk to that person."

The person should also be flexible, adaptable to change and willing to ask questions others don't want to hear, he said. Other desirable qualities for an IAM engineer are creativity and an ability to understand the business' functions and the technology in use.

"Find someone who can look at something and say, 'I can make that better,'" Shields said. "There are some things that simply cannot be taught."

IAM and security go hand in hand

Deutsche Bank is currently building up an IAM team that includes existing IT staff and external hires, which the company then trains on IAM skills. That involves four major steps: baseline IAM training, then vendor-specific education, then CISSP, followed by continuous learning over time via conferences, lunch and learns, and updated vendor training.

We need to make sure people have access to the right resources.

"We need to make sure people have access to the right resources," Grewe said. "We want to have people who are continuously developing."

General security skills are especially important for IAM engineer candidates, experts said. Sarah Squire, a senior technical architect at Ping Identity, started out by learning the important security specs and standards as a way toward training up on identity management.

"It's a lot of on-the-job training," Squire said. "We're starting to realize that we really need a base body of knowledge for the entire field."

For that reason, Squire along with Ian Glazer, vice president for identity product management at Salesforce, founded IDPro, a community for IAM professionals. Launched at last year's Identiverse (then Cloud Identity Summit), IDPro is currently forming the body of knowledge that an IAM engineer must know, and plans to offer a certification in the future, Squire said.

"It's really important that people who come in not only understand IAM but also really understand security," Grewe said.

It's also important to determine where within the organization those IAM professionals will live. Is it operations? Development? Security?

"A lot of people just don't know where that fits," Shields said. "There is nowhere better for them to be in my opinion than on the IT security team."

Grewe's team at Deutsche Bank, for instance, works under the chief security officer, which has a lot of budget to work with, he said. At IBM, the team that handles internal identity management works closely with HR and other groups that are involved in employees' access rights, said Heather Hinton, vice president and chief information security officer for IBM Hybrid Cloud.

"[Organizations] need to figure out how to be less siloed," she said.